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aIj‘ 


106 (SDNYRev. 01/17) Application for a Search Warrant 


United States District Court 


In the Matter of the Search of 

(Briefly describe the property to be searched 
or identify the person by name and address) 

See Attachment A 


APPLICATION FOR A SEARCH AND SEIZURE WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the 

property to be searched and give its location): 


for the 

43 ^ 


) 

) 
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located in the _ Southern District of_ New York _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attached Affidavit and its Attachment A 


The basis for the search under Fed. R. Crim. P. 41(c) is (check one ormbre)-. 
iS evidence of a crime; 

KJ contraband, fruits of crime, or other items illegally possessed; 

1D property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

Code Section(s) Ojfense Description(s) 

18 U S C §§ 401 ■ 793' Contempt of court; unlawful disclosure of classified information; unauthorized computer 
t nran'- -1 vq-i' oot^on access; obstruction of justice; smuggling contraband into prison; illegal acts related to 

I UdU, I DUd, I /"y I , //hzlA pornography. 

The application is based on these facts: 

See Attached Affidavit and its Attachment A 


sf Continued on the attached sheet 

sf Delayed notice of 30 days (give exact ending date if more than 30 days: _ 
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet' 


) is requested 


Sworn to before me and signed in my presence. 

Date: 10/03/2018 

City and state: New York, NY _ 





'^Ji^plicant's signature . 

Jeffrey.'pavid Pofialdson, f8i Speciai Agent 


’ , Printed name, and title 




Judge’s dgnature 

The Honorable Paul A. Grotty, U.S.D.J. 


Printed name and title 
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UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF NEW YORK 


In the Matter of the Application of the United 
States of America for a Search and Seizure 
Warrant for Documents Found in a Cell at the 
Metropolitan Correctional Center, 150 Park 
Row, New York, New York 10007, previously 
inhabited by Joshua Adam Schulte 


J g MAG 8442 

TO BE FILED UNDER SEAL 

Agent Affidavit in Support of 
Application for Search Warrant 


SOUTHERN DISTRICT OF NEW YORK) ss.: 

JEFF D. DONALDSON, being duly sworn, deposes and says: 

I. Introduction 

A. Affiant 

1. I am a Special Agent of the Federal Bureau of Investigation (“FBI”) assigned to the 

New York Field Office, and have been employed by the FBI since 2010.1 am currently assigned 
to a squad responsible for counterespionage matters and have worked in the field of 
counterintelligence from 2010 to present. In the course of my duties as a Special Agent, I am 
responsible for investigating offenses involving espionage and related violations of law, including 
unauthorized retention, gathering, transmitting or losing classified documents or materials; 
unauthorized removal and retention of classified documents or materials; illegally acting in the 
United States as a foreign agent; other national security offenses; and the making of false 
statements. As a result of my involvement in espionage investigations and investigations involving 
the unauthorized disclosure or retention of classified information, as well as my training in 
counterintelligence operations, I am familiar with the tactics, methods, and techniques of United 
States persons who possess, or have possessed a United States Government security clearance and 
may choose to harm the United States by misusing their access to classified information. I am also 
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familiar, though my training and experience with the use of computers in criminal activity and the 
forensic analysis of electronically stored information. 

2, I make this Affidavit in support of an application pursuant to Rule 41 of the Federal 
Rules of Criminal Procedure for a warrant to seize and review certain materials identified during 
the search of the Metropolitan Correctional Center (“MCC”), which took place on October 3,2018 
pursuant to a search warrant signed by the Court on October 2,2018 (the “MCC Search Warranf’). 
The MCC Search Warrant and underlying affidavit are attached to this application as Exhibit A 
and is incorporated by reference, including the defined terras identified therein. 

3. As described in more detail, this application seeks the authority to seize and search 

documents (the “Schulte Cell Documents”) collected from a cell formerly inhabited by Joshua 
Adam Schulte, among others. At least some of the Schulte Cell Documents appear to relate to the 
use of the Contraband Cellphones in the MCC and the creation of a false exculpatory document 
(specifically, a document purportedly written by an FBI whistleblower to Wikileaks exonerating 
Schulte), which are described in more detail below. Other of the Schulte Cell Documents, which 
the agents have not reviewed, bear indications that they were potentially created to aid in the 
preparation of Schulte’s legal defense. As a result, and out of an abundance of caution, this 
application requests permission to have law enforcement agents and prosecutors who are not part 
of the prosecution team (the “Wall Team”) search the Schulte Cell Documents first and segregate 
out any non-privileged documents that are responsive to this warrant. Only the segregated, non- 
privileged Schulte Cell Documents will be provided to the prosecution team. The remaining 
documents will be returned to the MCC for delivery to Schulte within 48 hours. 

4. This Affidavit is based upon my personal knowledge; my review of documents and 

other evidence; my conversations with other law enforcement personnel; and my training, 
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experience and advice received concerning the use of computers in criminal activity and the 
forensic analysis of electronically stored information. Because this Affidavit is being sub mi tted 
for the limited purpose of establishing probable cause, it does not include all the facts that I have 
learned during the course of my investigation. Where the contents of documents and the actions, 
statements, and conversations of others are reported herein, they are reported in substance and in 
part, except where otherwise indicated. 

B. The Subject Offenses 

5. For the reasons detailed below, I believe that there is probable cause that the Schulte 
Documents contain evidence, fruits, and instrumentalities of Title 18, United States Code, Sections 
401 (contempt of court), 793 (unlawful disclosure of classified information); 1030 (unauthorized 
computer access), 1503 (obstruction of justice), 1791 (smuggling contraband into a federal 
detention facility) and 2252A (illegal acts related to child pornography); as well as conspiracies 
and attempts to violate these provisions and aiding and abetting these offenses (the “Subject 
Offenses”). 

II. Probable Cause and Request to Search 

6. Based on my training, experience, and participation in this investigation, as well as 
my conversations with others, I have learned, among other things, that: 

a. On October 3, 2018, I and other law enforcement officers executed the 
MCC Search Warrant. Prior to the search, MCC officials had removed the Schulte Cell 
Documents, among other things, from Schulte’s former cell and stored them in an official office 
at the MCC. 

b. The Schulte Cell Documents are comprised of more than approximately 300 
pages of materials. In executing the MCC Search Warrant, the agents began to review the Schulte 
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Cell Documents. During that search, law enforcement officers encountered, among other things, 
the following: 

i. The Schulte Articles, as described in the MCC Search Warrant; 

ii. The Pro Se Bail Motion, as described in the MCC Search Warrant^; 

iii. A document that bore the name of an email account 
(johnsmith742965@gmail.com) identified on one of the Contraband Cellphones, as well as what 
appears to be the password for that account (the “JohnSmith Document”)^; 

iv. A document that was purportedly authored by a member of the FBI 
that appears to be intended for Wikileaks (the “Fake FBI Document”).^ The Fake FBI Document 
is purportedly from a whistleblower within the FBI who states, in substance and in part, that 
Schulte was not responsible for the Leak and that the FBI planted child pornography on his 
computer. 

c. As the agents were reviewing the Schulte Cell Documents pursuant to the 
MCC Search Warrant, they identified documents upon which there were markings that indicated 
they were potentially prepared to aid in Schulte’s defense. 

7. In light of the foregoing, this application seeks authority for the Wall Team to 
review the Schulte Cell Documents to segregate out any privileged documents. The Wall Team 
will then turn over the remainder of the documents to the FBI case agents involved in the 
prosecution who would review those documents for evidence of the Subject Offenses, including: 

^ The MCC Search Warrant does not permit the Government to seize the Pro Se Bail Motion, and 
the Government is not seeking that authority in this application. 

^ The Government is seeking a search warrant to search this email account in a separate search 
warrant. 

^ In prison calls with his parents, Schulte discussed, in substance and in part, having his parents 
attempt to contact Wikileaks. 
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a. The Schulte Articles, which are already subject to seizure pursuant to the 
MCC Search Warrant; 

b. Any documents, including the JohnSmith Document, pertaining to the 
smuggling in of the Contraband Cellphones and/or their use, which are already subject to seizure 
pursuant to the MCC Search Warrant; 

c. Any documents, including the Fake FBI Document, reflecting an attempt to 
obstruct justice through the creation of false documents; 

d. Any other documents that would he subj ect to seizure pursuant to the MCC 
Search Warrant. 

8. All privileged documents and documents not subject to seizure pursuant to this 
warrant will be returned to the MCC within 48 hours for delivery to Schulte pursuant to MCC 
protocols. 
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in. Conclusion and Ancillary Provisions 

9. Based on the foregoing, I respectfully request the court to issue a warrant to search 
and seize the items and information specified in Attachment A to this Affidavit and to the Search 
and Seizure Warrant. 

10. In light of the confidential nature of the continuing investigation, I respectfully 
request that this Affidavit be maintained under seal until the Court orders otherwise. 



Spfecial Agent 

Federal Bureau of Investigation 


Sworn to before me on 
this 3rd day of October 2018 



THE HONORABLE PAUL A. CROTTY 
UNITED STATES DISTRICT JUDGE 
SOUTHERN UlSt^RlCT OF NEW YORK 
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Attachment A 

I. Identification of Documents to Be Searched 

On October 3, 2018, law enforcement officers executed a search warrant at the 
Metropolitan Correctional Center (“MCC”) pursuant to a search warrant signed by the Court on 
October 2, 2018 (the “MCC Search Warrant”). The MCC Search Warrant is attached hereto as 
Exhibit A and is incorporated by reference, including the defined terms identified therein. Prior 
to that search, MCC officials had removed approximately 300 documents from a cell formerly 
inhabited by Joshua Adam Schulte (the “Schulte Cell Documents”) and moved those documents 
to an official office in the MCC. The Schulte Cell Documents are the subject of this warrant. 

II. E x ecution of the Warrant 

Law enforcement agents are permitted to execute the search warrant at any time in the day 
or night. Upon the execution of this warrant, notice will be provided at or as soon as possible after 
the execution of the search. 

ITT. Items to Be Searched and Seized 

A. Evidence, Fruits, and Instrumentalities of the Subject Offenses 
Pursuant to the process described below, the Schulte Cell Documents may be searched for 
the seizure of the following evidence, fruits, and instrumentalities of: Title 18, United States Code, 
Sections 401 (contempt of court); Title 18, United States Code, Section 793 (unlawful disclosure 
of classified information); Title 18, United States Code, Section 1030 (unauthorized computer 
access). Title 18, United States Code, Section 1503 (obstruction of justice). Title 18, United States 
Code, Section 1791 (smuggling contraband into a federal detention facility) and Title 18, United 
States Code, Section 2252A (illegal acts related to child pornography); as well as conspiracies and 
attempts to violate these provisions and aiding and abetting these offenses (the “Subject 
Offenses”): 
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a. The Schulte Articles, which are already subject to seizure pursuant to the 
MCC Search Warrant; 

b. Any documents, including the JohnSmith Document, pertaining to the 
smuggling in of the Contraband Cellphones and/or their use, which are already subject to seizure 
pursuant to the MCC Search Warrant; 

c. Any documents, including the Fake FBI Document, reflecting an attempt to 
obstruct justice through the creation of false documents; 

d. Any other documents that would be subj ect to seizure pursuant to the MCC 
Search Warrant. 

B. Wall Team Search Procedures 

1. The Schulte Cell Documents will first be reviewed by law enforcement agents and 
prosecutors who are not part of the prosecution team (the “Wall Team”) to segregate out any 
privileged documents. 

2. The Wall Team will then turn over the remainder of the documents to the FBI case 
agents involved in the prosecution who would review those documents for evidence of the Subject 
Offenses, as described above. 

3. All privileged documents and documents not subject to seizure pursuant to this 
warrant will be returned to the MCC within 48 hours for delivery to Schulte pursuant to MCC 
protocols. 
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AO 105 (SONY Kev. 01/17) Application &r a Search Wairant 


United States District Court 


la the Mattel of the Search of 

(Briefly describe the property to be searched 
or identify tEeperson by name arid address) 

See Attachment A 


for the 



) Case No. S1 17 Cr. 548 (PAG) 

) 

) 

) 


APPLICATION FORA SEARCH AND SEIZURE WARRANT 



I, a federal law enforcement ofScer or an attorney for the government, request a search warrant and state under 
penalty of peijury that I have reason to believe that on the following person or property (identfy the person or describe the 
property to be searched and g^Ve its location): 


located in the _ Southern District of New York _, there is now concealed (identify the 

person or describe the property to be seized): 

See Attached Affidavit and its Atfachmerit A 


The basis for the search under Fed, R. Crim. P, 41(c) is (chedc one or more):, 
iS evidence of a crime; 

0 contraband, Ixuits of crime, or other items illegally possessed; 

0 property designed for use, intended for nse, or used in committing a crime; 
O a person to be airested or a person who is unlawMIy restrained. 


The search is related to aviolation of: 


Code Seation(s) 

18U.S.C,§§401;793;1030; 
1343; 1603; 1791;2252A 


Offense Description(s) 

Contempt of court; unlawful disclosure of classified information; unauthorized computer 
access; wire fraud; obstruction of Justice; smuggling contraband Into prison; illegal acts 
related to child pornography. 


The application is based on these facts: 


See Attached Affidavit and its Attachment A 


af Continued on the attached sheet. 

sf Delayed notice of 30 days (give exact ending date if more than 30 days; _ 
under 18 U.S.C. § 3103 a, the basis of which is set forth on the attached she.cf, 


) is requested 



Jeffrqy bWld.DQnpldson,; FBI‘.Special Agent 


Sworn to before me and signed inmy presence. 

49fQar2inB" 


Date: 



City and state: New York, NY 


judge 'h 'slgria 
The Honorable Paul A. Grotty,.U.S.D.J. 


Printed name and title 


JAS 021096 
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UMTED STATES DISTRICT CODR.T 
SOUTHERN DISTRICT OF NEW YORN 


In Rie Matter of th.e Application of the United 
States of America for a Search Warrant for the 
Premises Known and Described as 7 South Unit, 
7 North Unit, Including the Cells Located In 
Those Units, and the Education Department’s 
Law Library on the Second Floor, located in 
Metropolitan Correctional Center, 150 ParkRow, 
New York, New Yoric 10007, as well as Any 
Closed Containers/Items Contained in the 
Premises 



TO BE FILED UNDER SEAL 

Agent Affidavit in Support of 
Application for Search Warrant 


SOUTHERN DISTRICT OF NEW YORK) ss.: 

JEFF D. DONALDSON, being duly sworn, deposes and says: 

I. Introduction 

A. Affiant 

1. I am a Special Agent of the Federal Bureau of Investigation (“PBI”) assigned to the 

New York Field Office, and have been employed by the FBI since 2010.1 am currently assigned 
to a squad responsible for counterespionage matters and have worked in the field of 
countermtelligence iirom 2010 to present. In- the course of iny duties as a Special Agent, I am 
responsible for investigating offienses involving espionage and related violations of law, including 
unauthorized retention, gathering, transmitting or losing classified documents or materials; 
unauthorized removal and retention of classified documents or materials; illegally acting in the 
United States as a foreign agent; other national security offenses; and the maldng of false 
statements. As.aresult ofmy involvement in espionage investigations and investigations involving 
the unauthorized disclosure or retention of classified information, as well as my trahiing in 
countermtelligence operations, I am familiar with the, tactics, methods, and techniques of United 
States persons who possess, or have possessed a United States Government security cleai-ance and 
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may choose to harm the United States by misusing their access to classified information. I am also 
familiar, though my training and experience with the use of computers in criminal activity and the 
forensic analysis of electronically stored information. 

2. I make this Affidavit in support of an application pursuant to Rule 41 of the Federal 

Rules of. Criminal Procedure for a second warrant to search the premises specified below (the 
“Subject Premises”) tor the items and information described in Attachment A. This Affidavit is 
based upon my personal knowledge; my review of documents and other evidence; my 
conversations with other law enforcement personnel; and my training, experience and advice 
received concerning the use of computers in criminal activity and the forensic analysis of 
electronically stored information (“ESI”). Because this Affidavit is being submitted for the limited 
purpose of establishing probable cause, it does hot include all the facts that I have learned during 
the course of my investigation. Where the contents of documents and the actions, statements, and 
conversations of ofhers are reported herein, they are reported in substance and in part, except where 
otherwise indicated. 

B. The Subject Premises 

3. The .Subject Premises is particularly described as the 7 South Unit (‘‘Unit-l”), 7 
North Unit (“Unit-2”), including the cells located in those units, and the Education Department’s 
law library on the second floor (the '“Law Library,” together with “Unit-1” and “Unit-2,” the 
“Subject Premises”) located .in Metropolitan Correctional Center, 150 Park Row, New York, New 
Yodc 10007. 

C. The Subject Offenses 

4, For the reasons detailed below, I believe that there is probable cause that the Subject 
Premises contain evidence, fruits, and instrumentalities of Title 18, United States Code, Sections 
401 (contempt of court), 793 (unlawful disclosure of classified information); 1030 (unauthorized 
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computer access), 1343 (wire fraud), 1503 (obstruction of justice), 1791 (smuggling contraband 
into a federal detention facility) and 2252A (Illegal acts related to child pornography); as well as 
conspiracies and attempts to violate these provisions and aiding and abetting these offenses, among 
other statutes (the “Subject Offenses”). 

D. Terminology 

5. The term “computer,” as used herein, is defined as set forth in 18 U.S.C. 
§ 1030(e)(1). 

6. The' terms "records,” “documents,” and “materials” include all information 
recorded in any form, visual or oral, and by any means, whether in handmade form (including, but 
not limited to, writings, drawings, paintings), photographic form (including, but not limited to, 
microfilm, microfiche, prints, slide.s, negatives, videotapes, motion pictures, photocopies) or 
electrical, electonic or magnetic form (including, but not limited to, tepe recordings, cassettes, 
compact .discs, electronic or magnetic storage devices such as floppy diskettes, hard disks, CD- 
ROMs, digital video disks (DVDs), Personal Digital Assistants (PDAs), Multi Media Cards' 
(MMCs), memory sticks, optical discs, printer buffers, smart cards, memory calculators, eleottonio 
dialers, Bernoulli drives, or electronic notebooks, as weU as digital data files and printouts or 
readouts Irom any magnetic, electrical or electronic storage device), as well as the equipment 
needed to record such information (including but not limited to cameras and video recording and 
storage devices).. 

II. Probable Cause and Request to Search 
A. Overview 

7. As described in further detail below, through this application, the Government 
seeks a warrant to search the Subject Premises for two iPhones one with TMRT 358793052665161 
and one with IMEI 354444064445994 (the “Contraband iPhones”); a Samsung cellphone with 

3 


JAS 021099 





Case l:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 16 of 50 


IMEI number 357073084445432 and/or Serial Number R58J61Q0JCD (the “Schulte CeUphone,” 
together with the Contraband iPhones, the “Contraband Cellphones”); and copies of certain 
documents written by Joshua Adam Schulte (the “Schulte Documents”), * Schulte—-who has been 
indicted for, among other things, possession of child pornography and unlawful disclosure of 
classified infoiniation—and another iiunate, Omar Amanat—who was convicted attrial of various 
forms of fraud, including securities ftaud—^have been using the Contraband Cellphones that were 
smuggled into the MCC to, among other things, fabricate evidence and disseminate information 
that is either protected by a comt-entered protective order or that is classiEed. 

B. Background on Amanat and Schulte’s Detention at the MCC 

8, Based on my training and experience, my participation in this investigation, and 
my conversations with other law enforcement agents and others, and my review of reports prepared 
- hy others, including other FBI agents, I have learned, among other things, that: 

a. Between in or about 2012 and November 2016, Schulte was employed hy 
the Central Intelligence Agency (the “CIA”). 

b. At the CIA, Schulte, worked at a specific group (the “CIA Group”) that, 
among other things, developed computer applications that the CIA used to gather intelligence 
abroad. 

c. As part of his work, Schulte developed specialized skills in, among other 
things, hacking computers and computer networks and secretly obtaining data from computers and 
computer networks, 

d. In or about November 2016, Schulte resigned from the CIA. Prior to his 
resignation, Schulte had disclosed to other CIA employees that he was angry at what he perceived 

^ One of the Contraband iPhones was seized hy the MCC on or about September 26,2018, 
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to be Ms mistreatment by CIA. management in connection with a dispute Schulte had had with 
another CLA employee. 

e. Beginning on or about March 7,2017 through in or about November 2017, 
the website wikileaks.org (“WildLeaks”) published information from the CIA Group at which 
Schulte previously worked (the “Leak”)- The Leak appears to be the largest unauthorized public 
disclosure of CIA information in the Mstory of the agency, 

f. On or about August, 24, 2017, the FBI arrested Schulte for, among other 
things, possession of child pornography, based on, in part, the FBI’s discovery of approximately 
10,000 images of apparent child pornography on a personal desktop computet used by Schulte. 

g. Schulte was initially released on bail on or about September 15,2017, over 
the Government’s objection. Schulte’s bail was revoked, however, in connection with his violation 
of Ms bail conditions, in particular, restrictions on Ms use of computers or the Internet. Schulte’s 
actions included, among other things, using an online network that allows for anonymous browsing 
of the Internet. Schulte has been detained atthe MCC since on or about December 14,2017. 

h. On or about June 18,2018, the Government filed a superseding indictment 
that, in addition to containing the original child pornography charges, also charged Schulte with 
violations of, among other statutes, Title 18, United States Code, Sections 793 and 1030, in 
connection with the Leak. 

i. The Government has produced to Schulte certain search warrant affidavits 
(the “Schulte Search Warant Affidavits”) pursuant to a protective order entered by the Court on 
or about September 18,2017 (the “Schulte Protective Order”). Based on the terms of the protective 
order, Schulte and his defense team were not permitted to disclose the Schulte Search Warrant 
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Affidavits or the information contained in them to anyone not involved in the preparation of 
Schnlte’s defense. 

9. Based on my training and experience, my participation in this investigations my 
review of reports and other documents prepared by others, and my conversations with other law 
enforcement agents and others, including an FBI agent involved in an earlier investigation and 
prosecution of Amanat, I have learned, among other things, that; 

a. ' On or about My 13, 2016, the Government filed a superseding indictment 
charging Amanat with wkc fraud, conspiracy to commit wire fraud, aiding and abetting investment 
advisor fraud, and conspiracy to commit securities fraud. 

b. Amanat was arrested that day andreleased on bail on or about My 22,2016. 

c. On or about December 26,2017, Amanat was convicted on all counts after 
a jury trial before the Honorable Paul G. Gardephe. 

d. Amanat has been detained at the MCC since on or about December 26, • 

2017. 

e. Amanatis currently scheduledto be sentenced on or about October 18, 2018 
although that sentencing date maybe adjourned because of requests by defense counsel for Amanat 
andhis co-defendant, Kaleillsaza Tuzman, for aifbPco hearing. Isaza Tuzman was also convicted 
on or about December 26,2017 and is currently-on bail pending sentencing, 

f. Amanat’s brother and co-defendant, Irfan Amanat, is scheduled to proceed 
to trial before Judge Gardephe on October 22, 2018, on charges of wire fraud, conspiracy to 
commit wire fiaud, aiding and abetting investment advisor fraud, and conspiracy to commit 
securities fraud. 
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10. Based on my training and experience, my participation in this inyestigation, my 
conversations with other law enforcement agents and others, and my review of reports and 
recorded telephone conversations, I have learned, among other things, that: 

a. Schulte and Amanat are cellmates at the MCC, and are housed In Unit-1.^ 

b. During recorded telephone conversations from, the MCC,^ Schulte has 
stated that he and Amanat are friends and that Schulte is helping Amanat with a report that will 
help to prove Amanafs alleged innocence. 

C. Schulte’s Violation of the Schulte Protective Order and Disclosure of Classified 
Information While at the MCC 

11. Based on my training and experience, my conversations with other law enforcement 
agents and others, my paiticipafron in this investigation, and my review of reports and recorded 
conversations, I have learned, among other things, that: 

a. In or about April 2018, in recorded calls from the MCC, Schulte discussed ’ 
with members of his family his desire to talk to members of the media about his case. Schulte also 
indicated that he had written several documents, which he called “articles,” that discussed Ms case 
(the “S ohulte Articles”) and which he wanted to be disseminated to the media. It appears from the 
calls that at least some of the Schulte Articles may have been provided to one or more members 
of the media. 

b. In or about April 2018, in arecorded call fi-om the MCC, Schulte spoke with 
an individual who- appeared to be a member of the media. During the call, Schulte discussed the 
information contained in one of the Schulte Search Warrant AJirdavits and why he felt that 

^ I rmderstand that based on some of the conduct described in this Affidavit, MCC officials may 
tnove Schulte to another part of the MCC so that he is no longer Amanat's ceUmate. 

^ All conversations or documents referenced in this Affidavit are described in substance and in 
part. 
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information was inaccurate. When asked if the information he was discussing was classified, 
Schulte responded that it was not classified, but that it was protected by the “protective order.” 
Nevertheless, Schulte contmued to disclose mformation found in one of the Schulte Search 
Warrant Affidavits. 

c. On or about May 15, 2018, the Washington Post and the New York Times 
published articles about Schulte’ s case, in which they indicated that then reporters had learned of 
information contained in at least one of the Schulte Search Warrant Affidavits. 

d. On or about May 21, 2018, at the Government’s request, the Court held a 
conference to address Schulte’s violation of the Schulte Protective Order. During the hearing, the 
Government noted, among other things, that it had reviewed recordings of calls Schulte had 
participated in irom the MCC. 

e. On or about June 20, 2018, at his arraignment on the superseding 
indictment, Schulte submitted a handwritten pm se bail motion to the Court (the “Pro Se Bail 



f. The day after Schulte submitted the Pro Se Bail Motion, the Government 
informed Schulte’s counsel that the Pro Se Bail Motion was undergoing a review by the CIA to 
determine whether it contained classified information, 

g. It appears that after the Government informed Schulte’s counsel about the 
classification review, Schulte may have sent the Pro Se Bail Motion to an attorney and .his parents. 

h. The CIA has reviewed the Pro Se Bail Motion and the Schulte Articles, and 
has dctonnined that the Pro Se Bail Motion and at least one of the Schulte Articles contain 
classified information. 
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D. Ararat’s I’aJjrication of Evidence Buring His Trial 

12. Based on my training and experience, my participation in this investigation, and 
toy conversations with other law enforcement agents and others, including an FBI agent involved 
in a prior investigation and prosecution of Amanat, I have learned, among other things, the 
following: 

a. Dui'ing his trial, Amanat sought to introduce, among other things, 
approximately live emails (the "Amanat Fabricated Emails”), four of which were admitted initially 
several in redacted form. 

b. In response, during two hearings held outside the presence of the jury as 
well as in a rebuttal case before the jury, the Government submitted evidence showing that the 
Amanat Fabricated Emails had been faked by Amanat, including, among other things; 

i. Evidence of discrepancies in header infoimation, including time 
stamps associated with the Amanat Fabricated Emails and other emails introduced at trial. 

ii. Evidence that certain of the Amanat Fabricated Emails were not 
found in certain email accounts or oh electronic media used by the purported recipients of the 
emails. 

iii. Evidence that the Amanat Fabricated Emails were inconsistent with, 
other contemporaneous and inculpatory communications involving Amanat. 

iv. An email communication between Amanat and his brother and co¬ 
defendant, Irfan Amanat, concemiiig how to delete emails fiom a certain email account. 

V. Expert testimony from an experienced FBI Special Agent assigned 
to a cyber squad that four of the five Amanat F abricated Emails were fake and/or were not sent on 
the date and time on which they appeared to have been sent 

c. As noted above, Amanat was convicted by the jury of all counts. 
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E. Schulte and Amanat Arrange to have Cellphones Smuggled into the MCC 

13. I have participated in an interview of an inmate at the MCC who was housed in 
Unit-IwithAmanatandSchult6un.tilrecentiy(the"CS^0'^ Duringthatinterview, 1 heCSreported 
that, among other things: 

a. For the-.past several months, the CS has been paid by Amanat to store and 
charge the Contraband Cellphones. 

b. The Contraband Cellphones were smuggled into the MCC and protected 
fi-om detection through a network of visitors to the facility, inmates, and correctional officers. 

c. For a time, the CS was tasked with storing and charging the Conhahand 
Cellphones in the CS’s cell. During that tune-period, the CS also loiew the passwords for the 
devices. 

d. At some point, Schulte decided that he no longer wanted the CS to know 
the password for the Schulte Cellphone orto store it. Since around that time, the Schulte Cellphone 
has been stored in other inmates’ cells. 

e. Schulte told the CS that Schulte had implemented certain secui'ity protocols 
with respect to the Schulte Cellphone, such as changing the cellphone’s unique device identifier 
and enabling a function by which all the data on the Schulte Cellphone would be deleted if 
someone other than Schulte tried to access the phone. 

f. Prior to Schulte’s retrieval of the Schulte Cellphone, the CS would regularly 
take screenshots of messages and recorded videos involving the Contraband Cellphones. The CS 


* The CS is facing immigration and narcotics trafficking charges, and is cooperating in the hope 
of receiving a more lenient sentence and potentially immigration benefits. As described in this 
Affidavit, the CS’s information has been at least partly corroborated by, among other things, a 
seizure of at least one contraband cellphone. 
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subsequently stored those screenshots in an email account the CS created (the “CS Account”). 
Based on these messages and the CS’s conversations with Schulte and Amanat, the CS understood 
that, among other things; 

i. Schulte and Amanat were using the Contraband Cellphones in 
connection with the creation of some sort of reportthat would be submittedto AmanaC s sentencing 
judge (Judge Gardcphe) to show that the Amanat Fabricated Emails were allegedly real. 

ii. The CS also recalled a communication over at least one of the . 
Contraband Cellphones relating to "Vault 7,” which is the name used by WikiLeaks for the Leak. 

g. Amanat and Schulte also discussed their need to have the Contraband 
Cellphones with them when they accessed discovery at the Law Library. 

h. During the interview, the CS consented to die search of the CS Account, 
and provided not only the name of the CS Account, but also the password for it. 

14. Based on my participation in this investigation, conversations with other 
participante in the investigation, and my review of reports prepared during the investigation, Ihave 
learned, among other things, that: 

a. IJnit-1 and Unit-2 are on the same floor oftheMCC and are connected by 

a corridor. 


b. Although inmates from the two units are prohibited from interacting with 
each other in the corridor between Unit-1 and Unit-2, inmates are, at times, able to meet briefly in 


that space. 

c. On of about on or about September 26,2018, MCC officials recovered one 
of the Contraband iPhones fi-om Unit-1. It doe.s not appear, however, that the other Contraband 
Cellphones have been recovered by-MCC officials yet. 
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d. The search for the other Contraband Cellphones is ongoing, and has 
inclnded, among, other things, searching multiple cells in XJnit-1, including Schulte and Amanat’s 
cell, and cells in proximity to their cell. 

F. Evidence of Schulte’s and Amanat’s Illegal Activity Using the Contraband 
f Cellphones 

15, Based on my review of the CS Account, rny participation in this mvestigation, 
conversations with other participants in the investigation, and my review of reports prepared 
during the investigation, I have learned, among other things, that: 

a. The CS Account contains approximately 450 electronic files (Including 
videos and photographs) of the Contraband Cellphones. These files include, among other things, 
video recordings of Schulte and Amanat using the' Contraband Cellphones and screenshots (or 
images) of communications received and/or sent using the Contraband Cellphones in connection 
with Schulte’s and Amanat’s intended fabrication of evidence and/or dissemination of materials 
protected by the Protective Order or that appear classified, including the Schulte Documents. 

h. Below are several still images talcen from videos retrieved fioin the CS 
Account that show Schulte and Amanat using the Contraband Cellphones in the MCC: 

Video 1 (Image 11 
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Video 2 flmage It 



Video 2 (Image 2i 
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D, Below are images from the CS Accormt leflectmg commuiucations using 
the Contraband Cellphones: 

i. The image below from one of the Contraband Cellphones appears 
to be a draft report prepared by Schulte and Amanat related to the fabricated emails fromAmanat’s 


trial. 



I- xnc'rt Report in United States vs. 
K.ilcil Isaza 'Riznisin, et nl. 15 Cr. 15 
(r>GG) for Omar Amanat 1/29/2018 

By: Joshua Schulte 


I: Intrdductioh 


I ar.i fhc founder and CEO of my own cmsuliitjc 
film. I was contacted and hired directly liy (Jni'ir 
Amanat to provide an expert '-pint in the in iller of 
United States v. Kaleil li.!’’.- 'In/innn, cl al. IS Cr. 

15 (POQ),; I-was retained pusl-veLilictOii 
due tn.conoems of unii.‘.!ii;l .and suspieious-behavior 
on behalf of the 1-1-il. I’liiiieiil.iiiy, Ihc expert 
fesh'rnony of Joel DeCapoa. 

[.imi ii.ili.. Mill the faers in (his declaration, 
from cither personal kiinwlcdgo or frtim documents 
that have been provided to me. Intiofar as lhcy.are| 
vyitiiin-niy owa (cnowledec, the facls,andiniattefi$-u& 
thisilri-l.nliin .in- tiii' i.i ilie bvt of my 
•ktrowlcdge and belief. I pcnionafi^'tea!i^^|H|M 
|^(i evidciicti .iiiildraiisctipls 
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The Image-below firom one of the Gontrahand Cellphones appears 


to he an email describing an excerpt from one of the Schulte Articles; 
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iii. The image below is a screenshot of what appears to be an email sent 


over one of the Contraband Cellphones. “Protonmail” is an encrypted email service based abroad, 
and the file “Schulte_Ha.. ._Notes.pdf’ appears to be a reference to the information, contained in 
the Pro Se Bail Motion. 
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iv. The image below is a screenshot of one of the Contraband 
Cellphones that depicts, certain applications that have been downloaded to the phone, including 
“Secure Delete” and “IShredder”: 
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G. probable Cause Justifying Search of ESI 

16. Based on the foregoing, and based on my training and experience, I ioiow that 

Amanat and Schulte have used (or are using) the Contraband Cellphones to, among other things, 
create documents and communicate with others outside the MCC. Moreover, like individuals 
engaged in any other kind of activity, individuals who engage in the Subject Offenses store records 
relating to their illegal activity and to persons involved with them in that activity on electronic 
devices such as the Contraband Cellphones. Such records can include, for example logs of online 
“chats” with co-conspirators; email correspondence; contact information of co-conspirators, 
including telephone numbers, email addresses, and identiSers for instant messaging and social 
medial accounts; stolen financial and personal identification data, including bank account 
numbers, credit card numbers, and names, addresses, telephone numbers, and social security 
numbers of other individuals; and/of records of illegal transactions using stolen financial and 
personal identification data. Individuals engaged in criminal activity often store such records m 
order to, among other things, (1) keep track of co-conspirators’ contact information; (2) keep a 
record of illegal transactions for future reference; (3) keep an accounting of illegal proceeds for 
purposes of, among other things, dividing those proceeds with co-conspirators; and (4) store stolen 
data for fixture exploitation. 

17. As a result, there is probable cause to believe that the. Contraband Cellphones 
contain some or all of the following: 

a. The phone numbers associated with the Contraband Cellphone's, as well as, 
call log information of phone numbers of incoming and outgoing, and missed or unanswered calls 
to and fi'om the Contraband Cellphones; 

b. Address bools and contact lists stored on the Contraband Cellphones or its 
memory oard(s); 
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c. Voicemail messages, opened or unopened, related to the Subject Offenses; 

d. Evidence concerning the identity or location of the ownei/s) or user(s) of 
the Contraband Cellphones; 

e. Evidence concerning the identity and/or location of the individual(s) 

involved in the co m mission of the Subject Offenses; 

f. Evidence of communications among, or concerning, participants in or 

witnesses to the commission of the Subject Offenses; 

g. Contact information of co-conspirators and witnesses to the commission of 
the Subject Offenses, including telephone numbers, email addresses, and identifiers for instant 
messaging and social media accounts; 

h. Text, data, "chats,” MMS (“Multimedia Messaging Sendee”) messages, 
SMS (“Short Message Service”) messages, FaceTime messages, and e-mail messages, any 
attspbmftnts to those messages, such as digital photographs and videos, and any associated 
information, such as the phone number or e-mail address from which the message was sent, 
pertaining to the Subject Offenses; 

i. Digital photographs and videos related to the Subject Offenses; 

j. Browsing history, websites visited, and internet searches conducted on the 

Contraband Cellphones related to the Subject Offenses. 

18. Based on my training and experience, I also Icnow that, where computers are used 

in furtherance of criminal activity, evidence of the criminal activity can often be found months or 

even years after it occurred. This is typically true because: 

• Electronic files can be stored on a hard drive for years at little or no cost and users tlius 
have little incentive to delete data that may be iiseM to consult in the future. 
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• Bveii when a user does choose to delete data, the data can often be recovered months 
or years later with the appropriate forensic tools. When a file is “deleted” on a home 
computer, the data contained in the file does not actually disappear, but instead remains 
on the hard drive, in “slack space,” until it is overwritten by new data that cannot be 
stored elsewhere on the computer. Similarly, files that have been viewed on the Internet 
are generally downloaded into a temporary Jhtemet directory or “cache,’’ which is only 
overwritten as the “cache” fills up and is replaced with more recently viewed Intemet 
pages. Thus, the ability to retrieve from a bard drive or other electronic storage media 
depends less on when the file was created or viewed than on a particular user’s 
operating system, storage capacity, and computer habits. 

'• In the event that a nser changes computers, the user will typically trarofer files ftom 
the old computer to the new computer, so as not to lose data. In addition, users ofien 
keep backups of their data on electronic storage media such as thumb drives, flash 
memory cards, CD-ROMs, or portable hard drives. 

19. Based on the foregoing, I respectfolly submitthere is probable cause to believe that 
Schulte and Amanat are engaged in the Subject Offenses, and that evidence of this criminal activity 
is likely to be found in the Subject Premises and on the Contraband Cellphones, 

m. Procedures for Searching ESI 
A. Execution of Warrant for ESI 

20. Federal Rule of Criminal Procedxue 41(e)(2)(B) provides that a warrant to search 
for and seize property “may authorize the seizure of electronic storage media or the seizure or 
copying of electronically stored mforraation .. . for later review.” Consistent with Rule 41, this 
application recpiests authorization to seize any computer devices and storage media and transport 
them to an appropriate law enforcement facility for review. This istypioally necessary for anumber 
of reasons: 

• First, the volume of data on computer devices and storage media is often impractical 
for law enforcement personnel to review in its entirety at the search location. 

• Second, because computer data is particularly vulnerable to inadvertent or intentional 
modification or destruction, computer devices are ideally examined in a controlled 
environment, such as a law enforcement laboratory, where trained personnel, using 
specialized software, can make a forensic copy of the storage media that can be 
subsequently reviewed in a manner that does not change the underlying data. 
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• Third, there are so many types of computer hardware and software in use today that it 
can be impossible to bring to the search site all of the necessary technical manuals and 
specialized personnel and equipment potentially required to safely access the 
underlying computer data. 

• Fourth, many factors can complicate and prolong recovery of data froni a computer 
device, including the increasingly common nse of passwords, encryption, or other 
features or Configurations designed to protect or conceal data on the computer, which 
often take considerable time and resouroes for forensic personnel to detect and resolve. 


B. Review ofESI 

21. Following seizure of any cellphones and/or the creation of forensic image copies, 
law enforcement personnel (who may include, hr addition to law enforcement officers and agents, 
attorneys for the government, attorney support staff, agency personnel assisting the government m 
this investigation, and outside Jechnical experts under goyeminent control) will review the ESI 
contained therein for information responsive to the warrant, 

22. In conducting this review, law enforcement personnel may use various techniques 
to determine which files or other ESI contain evidence or fruits of the Subject Offenses. Such 
techniques may include, for example: 

• surveying directories or folders and the individual files they contain (analogous to 
lookiag atthe outside of a file cabinet for the markings it contains and opening a drawer 
believed to oontahi pertinent files); 

• conducting a file-hy-file review by “openiug” or reading the first few “pages” of such 
files in order to determine tjheir precise contents (analogous to performing a cursoiy 
examination of each document in a file cabinet to determine its relevance); 

• “scanning” storage areas to discover and possibly recover recently deleted data or 
deliberately hidden files; and 

e performing electronic keyword searches through aU electronic storage areas to 
determine the existence and location of data potentially related to the subject matter of 
the investigation®; and 


® Keyword searches alone are typically inadequate to detect all relevant data. For one thing, 
keyword searches work only for text data, yet many types of files, such as images and videos, do 
not store data as searchable text. Moreover, even as to text data, there may be information properly 
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• reviewing metadataj system information, configuration files, registry data, and any 
other infoimation reflecting how, when, and by whom the computer was used. 

23. Law enforcement personnel will make reasonable efforts to restrict their search to 
Hata fallin g within the categories of evidence specified in the warrant Depending on the 
circumstances, however, law enforeement personnel may need to conduct a complete review of all 
the ESI from seized devices or storage media to evaluate its contents and to locate all data 
responsive to the warrant 

C. Return of ESI 

24. If the Government determines that the electronic devices are no longer necessary 
to retrieve and preserve the data, and the devices themselves are not subject to seizure pursuant to 
Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request. 
Computer data that is encrypted or unreadable will not be returned unless law enforeement 
personnel have determined that the data is not (i) an instrumentality of the offense, (ii) a iruit of 
the cr iminal acthdty, (iii) contraband, (iv) otherwise unlawfidly possessed, or (v) evidence of the 
Subject Offenses. 


subject to seizure but that is not captured by a keyword search because the information does not 
contain the keywords being searched. 
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IV. Conclusion and Ancillary Provisions 

25. Based on the foregoing, I respectfully request the court to issue a warrant to search 
and seize the items and information specified in Attachment A to this Affidavit and to the Search 
and Seizure Warrant.. 

26. hi light of the confidential nature of the continuing investigation, I respectfully 
request that this Affidavit be maiutained under seal until the Court orders otherwise. 



JEFF/D. DONALDSON 
Special Agent 

Federal Bureau of Investigation 


Sworn to before me on 
this ist ^ay of October 2018 





THE HONORABLE P Alt A. CRO'mi 
UNITED STATES DISTRICT lUDdH ,, 
SOUTHERN DISTRICT OF NEW YO]^';V 
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Attachment A 

I. Premises to be Searched'—Subject Premises 

The preiriises to be searched (the “Subj eot Premises”) is described as follows, and includes 

all looked and closed containers found therein: 

The Subject Premises is particularly described as the 7 South Unit, 7 North Unit, including 
the cells located in those units, and the Education Departmenf s law Ubtaiy on the second 
floor of the building, located in Metropolitan Correctional Center, 150 Park Row, New 
York, New York 10007. 

n. Execution of the Warrant 

Law enforcement agents are permitted to execute the search warrant at any thne in the day 
or nigbt. Upon the execution of this warrant, notice will be provided at or as soon as possible after 
the execution of the search, 
in. Items to Be Searched and Seized 

A. Evidence, Fruits, and Instrumentalities of the Subject Offenses 
The items to he searched and/or seized from the Subject Premises iuclude the following 
evidencBj ftuits, and instrumentalities of; Title 18, United States Code, Sections 401 (contempt of 
court); Title 18, United States Code, Section 793 (unlawful disclosure of classified information); 
Title 18, United States Code, Section 1030 (unauthorized computer access). Title 18, United States 
Code, Section 1343 (wire ftaud), Title IS, United States Code, Section 1503 (obstruction of 
justice). Title 18, United States Code, Section 1791 (smuggling contraband into a federal detention 
facility) and Title IS, United States Code, Section 2252A (illegal acts related to child 
pornography); as well as conspiracies and attempts to violate these provisions and aiding and 
abetting these offenses, among other statutes (the “Subject Offenses”): 

1. A Samsung cellphone with IMEI 357073084445432 and/or Serial Number 
RS8J61Q0JCD (the “Schulte Cellphone”). 
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2. An iPhone cellphone with IMEl 358793052665161 (“iPhone-l”); 

3. An iPhone cellphone with IMEI 354444Q64445994 (“iPhone-2,” together with 

iPhone-1 and the Schulte Cellphone, the “Contraband Cellphones”)- 

4. Evidence pertainhig to the snauggliftg in of the Contraband Cellphones. 

5. Evidence concerning the identity or location of, and communications with, any co¬ 
conspirators. 

6. Any and all notes, documents, records, correspondence, or materials, m any foimat 
and medium (including, but not limited to, envelopes, letters, papers, e-mail messages, chat logs 
and electronic messages, other digital data files and web cache information, and handwritten 
notes), pertaining to the unauthorized retention, gathering, and transmission of classified 
documents or materials, and the unauthorized removal and retention of classified documents or 
materials, and, inparficular, the documents hearingthe following titles or descriptions; 

a. Article 1: “Presumption of Innocence; A petition for redress of grievances 

b. Article 2; “Presumption of Innocence: A loss of citizenship” 

o. Articles: 'Tresumptionofhmooence: Do you want to play a game” 

d. Articled; “Presumption of Innocence: Detention is not punishment” 

e. Articles: “Presumption of Innocence: Innocent until proven Wealthy” 

f Articled: “Presumption of Innocence: Can you afford to be accused?” 

g. Article?: “Presumption of Innocence: A proposed solution” 

h. Articles: “Presumption of Innocence: Origins” 

i. Article 9: . unalienable Rights, that among these are Life, Liberty and 

the pursuit of Happiness” 
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7. Evidence of the Subject Offenses on the Contraband Cellphones, including: 


a. The phone numbers associated with the Contraband Cellphones^ as well as 
call log information of phone numbers of incoming and outgoing, and missed or unanswered calls 
to and from the Contraband Cellphones; 

b. Address books and contact lists stored on the Contraband Cellphones or its 
memory card(s); 

c. Voicemail messages, opened or unopened, related to the Snhject Offenses; 

d. Evidence concerning the identity or location of the owner(s) or user(s) of 
the Contraband Cellphones; 

e. Evidence concerning the identity and/or location of the individual(s) 
involved in the commission of the Subject Offenses; 

■f. Evidence of communications among, or concerning, participants in or 

witnesses to the commission of the Subject Offenses; 

g. Contact information of co-conspirators and witnesses to the commission of 
the Subject Offenses, including telephone numbers, email addresses, and identifiers for instant 
messaging and social media accounts; 

h. Text, data, "chats,” MMS (“Multimedia Messaging Service”) messages, 
SMS (“Short Message Service”) messages, FaceTime messages, and e-mail messages, any 
attachments to those messages, such as digital photographs and videos, and any associated 
information, such as the phone number or e-mail address from which the message was sent, 
pertaining to the Subject Offenses; 

i. Digital photographs and videos related to the Subject Offenses; 
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j. Browsing history, websites visited, and internet searches, conducted on the 

Contraband Cellphones related to the Subject Offenses. 

8, If law enforcement personnel seize the Contraband CeUphones, the personnel will 
search the device within a reasonable amount of time, not to exceed 60 days firom the date of 
execution of the warrant. If, after such a search has been conducted, it is determined that a 
computer or device contains any data listed in paragraphs 2 and 3, the Government will retam the 
computer or device. If it is determined that the. computer(s) or device(s) ai'e no longer necessary 
to retrieve and preserve the data, and the items are not subject to seimre pursuant to Federal Rule 
of Criminal Procedure 41(b), suchmaterials and/or equipmentwill be returned within areasonable 
time. In any event, such materials and/or equipment shall be returned no later than 60 days from 
the execution of this warrant, unless fiirther application is made to the Comt. 

B. Search and Seizui-e of Electronically Stored Information 

The items to be searched and seized ftom the Subject Premises also include any cellphones 
that may. contain any electronically stored infomiation falling within the categories set forth in 
Section IILA of this Attachment above, including, hut not limited to, desktop and laptop 
computers, disk drives, modems, thumb drives, personal digital assistants, smart phones, digital 
cameras, and scanners. The items to be searched and seized from the Subject Premises also 
include: 

1. Any items-or records needed to access the data stored on any seized or copied 
computer devices or storage media, including hut not limited to any physical keys, encryption 
devices, or records of login credentials, passwords, private encryption, keys, or sjmil.ar information. 
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2. Any items or records that may faciEtate a forensic examination of the computer 
devices or storage media, including any hardware or software manuals or other information 
concerning the configuration of the seized or copied computer devices or storage media. 

3. Any evidence concerning the persons with access to, contool over, or ownership of 
the seized or copied computer devices or storage media. 

C. Review of ESI 

Following seizure of any computer devices and storage media and/or the creation, of 
forensic image copies, law enforcement personnel (including, in addition to law enforcement 
officers and agents, and depending on the nature of the ESI and the status of the investigation and 
related proceedings, attorneys for the government, attorney support staff, agency personnel 
assisting the government in 'this investigation, and outside teclmical experts under government 
control) are authorized to review the ESI contained therein for information responsive to the. 

warrant 

In conducting this review, law enforcement persoimel may use. various techniques, 
including but not limited to: 

. surveying various file “directories" and the individual files they contain (analogous to 
looldng at the outside of a file cabinet for the markings it contains an d opening a drawer 
believed to contain pertinent files); 

• opening or cursorily reading the first few "pages" of such files in order to detemune 
their precise contents; 

• scanning storage areas to discover and possibly recover recently deleted files, 

• scanning storage areas for deliberately hidden files; 
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• performing key word searches ttirough all electronie storage areas to determine whether 
occurrences of language contained in such storage areas existthat are intimately related 
to the subject matter of the inveshgation; and 

• makin g reasonable elforts to utilize computer search methodology to search only for 
files, documents, or other electronically stored information within the categories 
identified in this Attachment. 
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AO 93 (SDNYRev. 01/17) Search and Seizure WaTrant 


United States District Court 

for the 


Southern District of New York 


in the Matter of the Search of 

(Briefly desaibe Ihe propeiiy to be searched 
or ident^ the person by name and address) 

See Attachment A 


) 

) Case No. S1 17 Cr. 648 (PAC) 

) 

) 

) 




SEARCH AND SEIZURE WARRANT 

To: Any authorized law enforcement officer 

An application hy a federal law enforcement officer or an attorney for the government requests the search 

ofthe following person or property located in the _ Southern District of _ New York _ 

(identijy the person or describe the property to be seai'ched and giye its Ideation)', 


See Attachment A 


I 


The person or property to he searched, descrihed above, is believed to conceal (identijy theperson or describe the property 
to be s&ized)\ 

See Attachment A 


The search and seiwe are related to violation(s) of (insert statutory citations): 

Title 18, United States Code, Sections 401 (contempt of court), 793 (uniawilil disclosure of classified informafion); 1030 (unauthorized computer access), 1343 
(wire fraud)j 1503 (obstruction of justice), 1791 (smuggling contraband into a federal detention facility) and 2252A (tllega! acts related to child pornography) 

I find that the affidavit(s), or any recorded testhnonyi establish probable cause to search and seize the person or 
property. i 


October 15,2018 


YOU ARE COMMANDED to execute this warrant on or before _ 

(not to exceed 14 days) 

^ at any time in the day or night as I find reasonable cause has been 
established. 


□ in the daytime 6:00 a.m. to 10 p.m. 


Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property 
taken to the person from whom, or from whose premises, the propeify was taken, or leave the copy and receipt at the 
place where the properiy was taken. 

The officer executing this warrant, or an officer present during the execufidh of the Watrarit,-innst mepare an 
inventory as required by law and promptly return this warrant arid inventory to thp .CletE of the Court:. ' 

^ Upon its return, this wan'ant and inventory should befiled under seal bythe Cleric ofthe Cptnt. - 

U,S$ilInitials 

U / ' - ' ■ 

al Ifindthatimmediatenotificationmay have an adverse result listed in 18 p.^,C. g ilOS (exceptfor 4elay 

of trial), and authorize the officer executing this wairant to delay notice to the who, or Whose property, will be 
searched or seized (checkthe appropriate box) Sffor 30 ttays (notto exceed30). 


□until, the facts justifying, &e later speerfe date oif • 

/ \ ■ / I r 


Date mid time issued: 


U(y 


City and state; 


Q fO^ 

New York, NY 



Jm%o’s sigmtw^e 

The Honorable Paul A. Crotty, U.S.D.J. 

Printed TtGme and title 
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AO 93 (SDNY Rev. Ol/n) Search md SeizureWairant CPage 2) 


Return 


Case No.: 

31 17 Cr. 648 (PAG) 


Date and time warrant executed; 


Copy of warrant and inventory left 'with: 


Inventory made in the presence of; 


Inventory of fee prop erty taken and name of any person/s) seized: 


Certification 


I declare under penalty of peiquryfeat tliis inventoiy is correct and was returned along with fee original wairant 
to fee Conit. 


Date: 


Exectfiliigofficer's signature. 


Printed name and title 
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Attachment A 

L Premises to he Searched—Subject Premises 

The.premises to be searched (the “SubjectPremises”) is described as follows, and itioludes 

all locked and closed containers found therein: 

The Subject Premises is particularly described asthe 7 South Unit, 7 North Unit, including 
the cells located in tho.so units, and the Education Department’s law library on the second 
floor of the. building, located in Metropolitan'Correctional Center^ 150 Park-Row, New 
York, New York 10007. 

n. Executioa of the Warrant 

Law enforcement agents are permitted to execute the search warrant at any time in the day 
or night. Upon the execution of this warrant, notice will be provided at or as soon as posable after 
the execution of the search, 
in. Items to Be Searched and Seized 

A. Evidencej Eraits, and Instrumentalities of the Subject Offenses 
The items to be .searched and/or seized ftom the Subject Premises Inolude the following 
evidence, fruits, and instrumentalities of: Title 18,. United States Code, Sections 401 (contempt of 
court); Title 18; United States Code, Section 793 (unlawful disclosure of clas.sifled information); 
Title 18, United Slates Code, Section 1030 (unauthorized computer, access). Title 18, United States 
Code, Section 1343 (wire &aud). Title 18, United States Code, Section 1503 (obstruction, of 
justice), Title. 18,United States Code, Section 1791 (smuggling contraband into, afederal detention 
facility) and Title IS, United States, • Code, Section 2252A (illegal acts related to child 
pornography); as well as conspiracies and attempts to violate these pfovisidiis and aiding and 
abetting these, offenses, among other statutes (the “Subject Offenses”): 

1. A Samsung cellphone with IMEl 357073084445432 and/or Serial Number 
R58J61Q0JCD (the “Schulte Cellphone”). 


JAS 021129 



Case l:17-cr-00548-PAC Document 98-2 Filed 06/18/19 Page 46 of 50 


2. An iPhone cellphone with IMEI358793052665161 (“iPhone-rO; 

3. An iPhone ceUphone with IMEI 354444064445994 C'iPhone-2 ” together with 
iPhone-l mdthe Schulte Cellphone, the “Contraband CeUphones”). 

4. Bvidehce pertaining to the smuggling in of the Contraband Cellphones. 

5. Evidence concerning the identity or location Of, and communications with, any co- 
cOnspicators. 

6. Any and aU notes, documents, records, correspondence, or naaterials, in any fomiat 
and medium (including, but not limited to, envelopes, letters, papers, e-mail messages, chat togs 
and electronic messages, other digital data files and weh cache information, and handwritten 
notes), pertaining to the unauthorized retention, gatherings and transmission of classified 
documents or materials, and the unauthorized removal and. reteutibn of classified documents oi 
materials, and, in paitlcular, the documents hearing the following titles or descriptions; 

a. Article 1,: “Presumption of Innocence; Apetitionfor redress of grievances” 

b. Article 2: “Presumption of Innocence: A loss of citizenship” 

c. Article 3; “Presumption of Innocence: Do you want to play a game” 

d. Articled: “Presumption of Innocence: Detention Is not punishmept” . 

& Article 5: “Presumption of hmohence:. hmocsrit until proven Wealthy” 

f. Article 6: “Presumption of hmoeencec Can you afford to be accnsed?” 

g. Article?: “Presumption of Ipnocence: A proposed solution” 

h. Article 8; “Presumption of Innocence: Origins” 

i. Article 9; .. unalienable Rights, that among these are Life, Liberty and 

the pursuit of Happiness” 
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7, Evidence of the Subject Offenses on the Contraband Cellphones, including; 

a. The phone numbers associated with the Contraband Cellphones, as well as 
call log information of phone numbers of incoming and outgoing, and missed or unanswered calls 
to and from the Contraband Cellphones; 

b. Address books and contact lists stored on the Contraband Cellphones or its 


memory card(s); 

c. Voicemail messages, opened or unopened, related to the Subject Offenses, 

d. Evidence concerning the identity or location of the owner(s) or us6r(s) of 
the Contraband Cellphones; 

e. Evidence concerning the identity and/or location of the individual(s) 

involved in the commission of the Subject Offenses; 

f. Evidence of communications among, or concerning, participants in or 

witnesses to the commission of the Subject Offenses; 

g. Contact information of co-Gonspirators and witnesses to the commission of 
the Subject Offenses, including telephone mimbers, email addresses, and identifiers for instant 


messaging and social media accounts; 

h. Text, data, “chats,” MMS (“Multimedia Messaging Service”) messages, 
SMS (“Short Message Service”) messages, FaceTime messages, and e-mail messages; any 
attachments to those fnessages, such as digital photographs and videos, and any associated 
information, such as the phone number or e-mail address fiom which the message was sent, 


pertaining to the Subject Offenses; 

i. Digital photographs and videos related to the Subject Offenses; 
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j. Browsing history, websites visited, and internet searches condncted. on the 

Contraband Cellphones related to the Subject Offenses. 

8. If la'W enfprcettient personnel seize the Contraband Cellphone,s, the personnel will 

search the device widiin a reasonable amount of time, not to exceed 60 days from the date of 
execution, of the warrant If, after such a search has been Conducted, it is determined that a 
coJliputer or device contains any data listed in paragraphs 2 and 3 , the GovenuneUt will retain the 
computer or device. If it is determined that the computer(s) or devi'ce(s) are .no longer necessary 
to retrieve and preserve the data, and the items are not subject to seizure pui-suant to Federal Rule 
of Criminal Procedure 41 (b), suchmaterials and/or equipment will be returned within a reasonable 
time. In any event, such materials and/or equipment shall he retuftted no later than 60 days from 
the execution of this warrant, unless further application is made to the Couit. 

B. Search and Seizure of Electronically Stored Information 

The hertis to be searched and seized ftom the Subject Premises, also include any cellphones 
that iday contain any electronically stored information falling within the categories set forth, in 
Section ITT A of this Attachment above, mcluding, hut not limited to, desictop and laptop 
computers, dish drives, modems, thumb drives, personal digital 'assistants, srhait phones, digital 
cameras,, and scanners. The items to he searched and seized ftmn the. Subject Prelliis,es also 
inolndc: 

1. Any items or records' needed to access the data stored on any seized or copied 
computer de'vices or storage media, including but not limited to any physical keys, encryption 
devices,, or records of login credentials^ passwords, privafe encryption keys, or similar, information. 
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2, Any items or records that may facilitate 'a forensic examination of the computer 
devices or storage media, including any hardware or software manuals or other information 
concerning the configuration of the seized or copied computer devices or storage media. 

3. Any evidence concerning the persons with access to, control over, ox ownership of 
the seized or copied computer devices or storage media. 

C. Review of ESI 

Following seizure of any computer devices and storage media and/or the creation of 
forensic image copies, law enforcement personnel (including, in addition to law enforcement 
officers and agents, and depending on the nature of the ESI and the status of the investigation and 
related proceedings, attorneys for the government, attorney support staff, agency personnel 
assisting the government in this investigation, and outside technical experts under government 
control) are authorized to review the ESI contained therein for information responsive to the 
wanunt. 

In conducting this review, law enforcement personnel may use various techniques, 
including but not limited to; 

• sui-veying various file "directories" and the individual files they contain (analogous to 
looldng at the outside of a file cabinet for the maddngs it contains and opening a drawer 

' believed to contain pertinent files); 

• opening or cursorily reading-the first few "pages" of such files in order to determine 
theh precise contents; 

• scanning storage areas to discover and possibly recover recently deleted files, 

• scanning storage areas fox deliberately hidden files; 
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» perfbmiiag key word searches through all electronic storage areas to determine whether 
occxirrences of language contained in such storage areas exist that ate intimately related 
to the subj ect matter of the investigation; and 

« maldng reasonable efforts to utilize computer search methodology to search only for 
flies, documents, or other electronically stored information within the categories 
identified in this Attachment. 
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